Step 5: Install the API gateway

Install the API gateway before OpenLM Platform. The web UIs send their data requests to https://<your address>/api/..., and the gateway receives each one and passes it to the matching service. The gateway is a separate, small Helm release.

Load the variables from openlm-install.env, the file you created from the installation worksheet:

source ./openlm-install.env

5.1 Add the OpenLM Helm repository

You added the repository in step 4, so update it now. Install the latest API gateway release with every OpenLM Platform release. While the charts are release candidates, Helm finds it only with --devel.

helm repo add openlm https://openlm-helm.github.io/helmcharts && helm repo update openlm

The gateway chart is openlm/openlm-apigateway. If the machine you run Helm on can't reach the internet, download the chart on a machine that can, with helm pull openlm/openlm-apigateway --devel. It may print unable to find exact version requested; falling back to closest available version, which is harmless. Copy the .tgz file over and use it in place of openlm/openlm-apigateway in 5.4. The cluster also needs the gateway images: see Private registry (air-gapped) under Settings reference on the API gateway page.

5.2 Create the gateway secrets

Store the gateway's API secret and the Redis password in two Kubernetes secrets:

kubectl -n "$NS" create secret generic openlm-gateway-secrets \
  --from-literal=APISecret="$GATEWAY_SECRET" --dry-run=client -o yaml | kubectl -n "$NS" apply -f -
kubectl -n "$NS" create secret generic openlm-gateway-redis \
  --from-literal=password="$REDIS_PASSWORD" --dry-run=client -o yaml | kubectl -n "$NS" apply -f -

5.3 Write the gateway values

Write the gateway settings to gateway-values.yaml:

cat > gateway-values.yaml <<EOF
openShiftRoute: { enabled: $ON_OPENSHIFT, host: "$DOMAIN" }   # OpenShift: the gateway creates the /api Route
storageClassName: $STORAGE_CLASS
tyk-oss:
  global:
    secrets:
      useSecretName: openlm-gateway-secrets
    redis:
      addrs: ["$REDIS_HOST:$REDIS_PORT"]
      useSSL: $REDIS_TLS
      passSecret: { name: openlm-gateway-redis, keyName: password }
      storage: { database: 0 }
  tyk-gateway:
    gateway:
      hostName: $DOMAIN
      ingress: { enabled: false }        # /api is part of the platform's single Ingress
EOF

5.4 Install the gateway

Name the release exactly openlm-gateway. OpenLM Platform sends /api to a service whose name comes from the release name. For every gateway setting, see API gateway.

Install the release:

helm upgrade --install openlm-gateway openlm/openlm-apigateway --devel \
  -n "$NS" -f gateway-values.yaml --wait --timeout 10m

Check

Confirm that the gateway runs:

kubectl -n "$NS" get pods | grep gateway
kubectl -n "$NS" get service gateway-svc-openlm-gateway-tyk-gateway
# OpenShift only:
oc -n "$NS" get route openlm-gateway -o custom-columns=HOST:.spec.host,PATH:.spec.path

The gateway pod is Running and 1/1, and the service exists. On OpenShift, the openlm-gateway Route shows your DOMAIN and the path /api. If the pod restarts, read its log with kubectl -n $NS logs <gateway pod name>. If the errors mention redis, check REDIS_HOST, REDIS_PASSWORD, and REDIS_TLS.